nsroot: Minimalist Process Isolation Tool Implemented With Linux Namespaces
Inge Alexander Raknes, Bj{\o}rn Fjukstad, Lars Ailo Bongo

TL;DR
nsroot is a lightweight, root-privilege-free process isolation tool based on Linux namespaces, designed for secure, easy deployment of data analysis tools on shared Linux systems, including HPC environments.
Contribution
It introduces a simple, minimalistic process isolation utility that does not require root access, facilitating secure execution of applications on Linux systems with user namespaces.
Findings
Works on all Linux kernels with user namespaces
Provides a chroot-like command line interface
Enables secure execution without root privileges
Abstract
Data analyses in the life sciences are moving from tools run on a personal computer to services run on large computing platforms. This creates a need to package tools and dependencies for easy installation, configuration and deployment on distributed platforms. In addition, for secure execution there is a need for process isolation on a shared platform. Existing virtual machine and container technologies are often more complex than traditional Unix utilities, like chroot, and often require root privileges in order to set up or use. This is especially challenging on HPC systems where users typically do not have root access. We therefore present nsroot, a lightweight Linux namespaces based process isolation tool. It allows restricting the runtime environment of data analysis tools that may not have been designed with security as a top priority, in order to reduce the risk and consequences…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Code & Models
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
Taxonomy
TopicsBusiness Process Modeling and Analysis · Scientific Computing and Data Management · Distributed and Parallel Computing Systems
